CVE-2024-21574
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server b…
Published: 2024-12-12 · CVSS: 10.0 · CVSS 4.0
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7